Predictive model application for file upload blocking determinations

Patent metadata

Field	Value
Publication number	US-11483375-B2
Application number	US-202016907004-A
Country	US
Kind code	B2
Filing date	Jun 19, 2020
Priority date	Jun 19, 2020
Publication date	Oct 25, 2022
Grant date	Oct 25, 2022

Abstract

According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to receive a request to upload a file to a directory and determine whether the request is a request to upload a predefined type of file to the directory. In addition, based on a determination that the request is a request to upload the predefined type of file to the directory, the processor may determine, through application of a predictive model, whether the directory is a user content directory and based on a determination that the application of the predictive model indicates that the directory is a user content directory, block the request and/or output a notification regarding the receipt of the request.

First claim

What is claimed is:

1. An apparatus comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the processor to:
receive a request to upload a file to a particular directory;
determine whether the file in the request is an executable file or a predefined type of executable file;
based on a determination that the file in the request is an executable file or a predefined type of executable file, determine, through application of a predictive model that is generated through implementation of a machine learning operation on a training set of data, wherein the training set of data includes data pertaining to user uploads of multiple types of files to directories, whether the particular directory in the request is a user content directory by inputting a name of the particular directory from the request into the predictive model and applying the predictive model to determine whether the particular directory is a user content directory, wherein the user content directory is a type of directory that normally does not receive executable files from users; and
based on the determination that the file in the request is an executable file or a predefined type of executable file and based on a determination that the particular directory in the request is a user content directory, block the request and output a notification regarding the receipt of the request.

2. The apparatus of claim 1 , wherein the instructions cause the processor:
based on the determination that the file in the request is an executable file or a predefined type of executable file and based on a determination that the particular directory in the request is not a user content directory, permit the request to be fulfilled.

3. The apparatus of claim 1 , wherein the instructions cause the processor to:
receive the request from a client device via a network.

4. The apparatus of claim 1 , wherein the apparatus comprises a network gateway.

5. The apparatus of claim 1 , wherein, based on the determination that the file in the request is an executable file or a predefined type of executable file and based on a determination that the particular directory in the request is not a user content directory, permit the file to be uploaded to the particular directory.

6. The apparatus of claim 1 , wherein the particular directory comprises a folder or a uniform resource locator.

7. The apparatus of claim 1 , wherein the predictive model is generated and stored in a data store and wherein the instructions cause the processor to:
access the generated predictive model from the data store.

8. A method comprising:
generating, by a processor, a predictive model that is generated through implementation of a machine learning operation using a training set of data, wherein the training set of data includes data pertaining to user uploads of multiple types of files to directories;
accessing, by the processor, a request to upload a file to a particular directory;
determining, by the processor, whether the file in the request is an executable file;
based on a determination that the file in the request is an executable file, inputting, by the processor, a name of the particular directory from the request into the predictive model and applying, by the processor, the predictive model to determine whether the particular directory in the request is a directory that normally receives executable files from users; and
based on the determination that the file in the request is an executable file and based on a determination that the particular directory in the request is a directory that normally receives executable files from users, permitting, by the processor, the file in the request to be uploaded to the particular directory.

9. The method of claim 8 , further comprising:
based on the determination that the file in the request is an executable file and a determination that the particular directory is a directory that does not normally receive executable files from users, denying an upload of the file in the request to the particular directory.

10. The method of claim 8 , further comprising:
based on the determination that the file in the request is an executable file and a determination that the particular directory is a directory that does not normally receive executable files from users, outputting an indication that an attempt was made to upload the file to the particular directory.

11. The method of claim 8 , wherein the predictive model is to be used to classify directories as to receive executable files from users or not to receive executable files from users.

12. The method of claim 11 , wherein accessing the training set of data further comprises accessing manually curated data or accessing real world data pertaining to the user uploads of the multiple types of files to directories.

13. The method of claim 8 , further comprising:
applying a machine learning operation on the training set of data to generate the predictive model.

14. The method of claim 8 , further comprising:
accessing the request to upload the file to the particular directory at a gateway of a network; and
based on the determination that the file in the request is an executable file and a determination that the particular directory is a directory that does not normally receive executable files from users, denying an upload of the file in the request to the particular directory at the gateway.

15. The method of claim 8 , further comprising:
forwarding the request to upload the file to a server, wherein the server is to apply the predictive model on the particular directory to determine whether the particular directory is a directory that normally receives executable files from users; and
receiving, from the server, the determination that the particular directory is a directory that does not normally receive executable files from users.

16. The method of claim 8 , wherein the file in the request is a server-side executable file and the particular directory in the request is a user content directory.

17. A non-transitory computer-readable medium storing computer-readable instructions that when executed by a processor, cause the processor to:
receive a request to upload a file to a particular directory;
determine whether the file in the request is an executable file;
based on a determination that the file in the request is an executable file, determine, through application of a predictive model that is generated through implementation of a machine learning operation on a training set of data, wherein the training set of data includes data pertaining to user uploads of multiple types of files to directories, whether the particular directory in the request is a directory that normally receives executable files by inputting a name of the particular directory from the request into the predictive model and applying the predictive model to determine whether the particular directory is a directory that normally receives executable files; and
based on the determination that the file in the request is an executable file and based on a determination that the particular directory in the request is a directory that does not normally receive executable files, block the request and output a notification regarding the receipt of the request.

18. The non-transitory computer-readable medium of claim 17 ,
wherein the predictive model is to be used to classify the directories as being to receive a predefined type of files from users or not being to receive the predefined type of files from users.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Karin Omer
• Weizman Josef
• Pliskin Ram Haim

Classifications

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06F16/955

  using information identifiers, e.g. uniform resource locators [URL] · CPC title

• H04L12/66

  Arrangements for connecting between networks having differing types of switching systems, e.g. gateways · CPC title

• G06F16/13

  File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title